Announcement

Collapse
No announcement yet.

user spaming himself?!?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • user spaming himself?!?

    I have a user who receives spam with a from and reply to address identical to his address. I'm not sure where to begin stopping this. The exchange forum seemed like a good start.

    I enabled IMF but I'm not familiar with the configuration other than the SCL rating which would probably have no effect on emails from ones self.

    Thanks for any ideas,
    Robert

  • #2
    Re: user spaming himself?!?

    The actual source of the email will be from "outside". (i.e.e the from address will be spoofed).

    The trick is to configure your mail relay to only accept mail from outside, when the "From" address is NOT one of your own domains.

    Code:
    PSEUDO-CODE
    
    IF (<sender> EQU *.mydomain.net AND <source> EQU <outside interface>) THEN REJECT


    Tom
    For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

    Anything you say will be misquoted and used against you

    Comment


    • #3
      Re: user spaming himself?!?

      How do I do that, with exchange?

      Comment


      • #4
        Re: user spaming himself?!?

        I had this problem, if you use them IMF viewer and look at the raw message, you will find the sender address. You'll have to look through the raw message carefully.
        Please remember to award reputation points if you have received good advice.
        I do tend to think 'outside the box' so others may not always share the same views.

        MCITP -W7,
        MCSA+Messaging, CCENT, ICND2 slowly getting around to.

        Comment


        • #5
          Re: user spaming himself?!?

          Originally posted by rd42 View Post
          How do I do that, with exchange?
          Are you using Exchange as your Mail Relay?


          Tom
          For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

          Anything you say will be misquoted and used against you

          Comment


          • #6
            Re: user spaming himself?!?

            I am using exchange as my relay...

            I set up IMF and it catches many of them. They do not all originate from the same IP though so I can't just block that one address.
            IMF gives this on the ones it has caught:
            Received: from 18971103092.user.veloxzone.com.br ([189.71.114.80] RDNS failed)

            I'm not sure how to catch the others.
            Last edited by rd42; 25th January 2009, 23:54.

            Comment


            • #7
              Re: user spaming himself?!?

              If you are using nothing but IMF on the server I'd recommend investing in a decent Exchange aware security product. Sophos PureMessage or GFI MailSecurity or something like that will block these messages and protect your Exchange Server from more security threats than just spam.
              BSc, MCSA: Server 2008, MCSE, MCSA: Messaging, MCTS
              sigpic
              Cruachan's Blog

              Comment

              Working...
              X